The Hamelin language
Hamelin is a pipe-based query language for event analytics, built for the challenges detection engineers face when analyzing security events. The language makes event correlation straightforward, letting you define patterns, correlate them across time windows, and match ordered sequences of events. Perpetual uses Hamelin for parser and mapper definitions, detection queries, dashboard panels, and interactive queries.
Perpetual uses Hamelin throughout the product
Every interactive query you run in Perpetual is Hamelin. The same language defines dashboard panels, detections, and the parsers and mappers inside integrations. All of these uses share Hamelin as their query language. You carry the same Hamelin knowledge from interactive exploration into content authoring.
Query fragments can often be repurposed
Query reuse can begin with a complete hunt or with a smaller fragment of its logic. An interactive hunt can provide the starting point for a dashboard panel or detection. You can reuse the hunt's complete Hamelin query in a panel and add the visualization configuration that presents its results. You can reuse the hunt's matching logic in a detection, then add the required signal output and satisfy the restrictions for continuous execution.
A deployed detection can also become a starting point for exploration. You can bring its query into the interactive Query surface, adjust its time range or conditions, and examine the events it matches.
You can repurpose the part of a query that expresses useful filtering, aggregation, or correlation on its own. You can use an interactive query over raw connector events to develop the field-extraction expressions that later become part of a parser. You can use an interactive query over a parser's output to develop the field mappings and transformations that later become part of a mapper.
Hamelin makes Simba’s query work inspectable
The Simba agent also writes and runs Hamelin to answer data questions and author query-bearing content such as detections, parsers, mappers, and dashboard panels. Hamelin makes that work inspectable because you can examine the exact query Simba runs or places into staged content. You can open a completed interactive query in the Query page. A query Simba authors remains visible in its changeset and editor.
Mastering Hamelin lets you help Simba refine queries across the product instead of relying on every query it produces to be correct on the first attempt. You have one language to learn whether you are improving an interactive query, parser, mapper, dashboard panel, or detection.
Type-checker errors make query failures actionable. Simba can revise a query before trying again because the errors identify the problem. You can see why a query failed and help Simba correct it because the Query surface shows the errors to you as well. A query that passes those checks can still express the wrong security logic. You decide whether the query tells Perpetual to do what you intended.
Each execution context can restrict query shapes
While Hamelin is one language with one type system, each execution context may place restrictions on query shapes.
Hamelin's type checker performs semantic analysis, computes the query's output field types, and validates that the query is a correct Hamelin query. Perpetual then validates whether the execution context allows that query shape. A query can therefore be valid Hamelin and still fail context validation.
Perpetual runs parser queries during ingestion, interactive queries on request, dashboard-panel queries when a panel loads or refreshes, and detection queries continuously. Those execution requirements determine which query shapes Perpetual allows in each context.
A parser extracts and structures raw connector events during ingestion. Perpetual disallows commands that combine events or depend on their ordering in parsers. A parser query can therefore be valid Hamelin and fail parser validation.
Detection and continuous-table queries must be incremental because they update their results as new events arrive. Perpetual disallows commands that require recomputing the complete event history in continuous queries. The materialization engine must be able to update the result from new rows and bounded earlier context.
The interactive Query surface supports query shapes that parsers and continuous resources restrict. A query that runs interactively may therefore need changes before it can become a parser, detection, or continuous table. You adapt the query to the destination's execution requirements using the same Hamelin language.